Split radix multiplication

Abstract

A first number is multiplied by a second number, by representing the first number as a first set of one or more w-bit wide numbers, and representing the second number as a second set of one or more w-bit wide numbers. Each of the w-bit wide numbers from the first set is paired with each of the w-bit wide numbers from the second set. For each pair of w-bit wide numbers, a set of sub-partial products is generated. Combinations of the sub-partial products are formed such that each combination is representable by a w-bit wide lower partial product and a carry out term that has fewer than w bits. The w-bit wide lower partial products and the carry out terms are combined to form the product of the first number and the second number. The carry out term is advantageously representable by (w/2)+1 bits.

Description

BACKGROUND

The present invention relates to automated multiplication, and more particularly to efficient automated multiplication that is especially well suited for multiplication of large numbers.

Hardware-implemented techniques for multiplying two numbers together are well known. In many processing system architectures, it is adequate to accomplish multiplication by iteratively instructing generic logic, such as an arithmetic logic unit (ALU), to perform suitable add and shift operations to generate the final product. However, it is often desirable to make available very fast multiplication operations, and to this end specialized multiplication logic is often provided. Such logic is often separate and apart from the central processing unit (CPU).

Hardware mapped multiplier units are very useful so long as the size (i.e., word length) of the input operands is comparable to size of the computational data paths for communicating those operands. However, in many applications (e.g., cryptographic algorithms) it is necessary to multiply together operands that are much larger than the size of the computational data path. In such cases, it is impractical to implement the desired multiplication using a hardware-mapped multiplication unit. Instead, one or both of the operands are broken up into parts, and the hardware data path is conventionally reused in a time-multiplexed fashion, operating on the parts, or words, of the input numbers. Hardware reuse is also the case for software implementation on standard microprocessors having a fixed word length data path.

The operation of carrying out a part of the multiplication for each word is denoted “partial product generation.” In order to have a fast execution time, the number of iterations is minimized by using a large word length (also denoted “high radix”) for the partial product generation. Unfortunately, higher radices imply longer carry chains and intermediate carry signals width larger word length, thereby slowing down operation and increasing power consumption. This can be seen from the following analysis:

A positive integer N-bit number a can then be written as a sequence of W-bit words a_i as

$a=\sum _{i=0}^{N/W-1}{a}_i{2}^{\mathrm{Wi}}.$
The generalization to negative and fractional numbers is straightforward, but not included in the calculations for the sake of simplicity. The multiplication of two words, x=ab may be calculated by generating partial products from the W-bit words a_i and b_i, and combining the partial products. More specifically, the product x may be calculated according to

$x=\sum _{i=0}^{N/W-1}\sum _{j=0}^{N/W-1}{a}_i{b}_j{2}^{W\left(i+j\right)},$
where the partial product, x_i,j is generated from two W-bit numbers, a_i and b_j as
x_i,j=a_ib_j.
For a word length W, the partial products are simply calculated as W×W multiplications as indicated in the equation above. To calculate the complete product x=ab, all partial products are generated and added together according to their significance.

One partial product slice 101 is shown in FIG. 1. The rhombic shape is due to the significance of each of the partial product bits; significance increases when going from right to left in the figure. FIG. 2 is a diagram depicting how all of the required partial products are mathematically combined to generate the complete product. It is apparent from the figure that the computed result from one slice should be combined with the result from the neighboring slices to the left and right, and that these combination results are also accumulated with the values generated by the slices above and below.

The partial product x_i,j is 2W bits wide, and is conventionally divided into two W-bit wide words, herein denoted carry (c_i,j) and lower partial product (p_i,j), as
x_i,j=2^Wc_i,j+p_i,j,
or
c_i,j=int(x_i,j/2^W) and p_i,j=x_i,j mod2^W,
where “int( )” is a function that generates the integer part of a number, and “mod n” indicates modulo n arithmetic.

Assume that it is desired to multiply two large numbers A and B, each of word length N, stored in a memory of word length W. Then, each number consists of N/W words (assuming that W is a factor of N). Let T be a storage area of 2N bits, or equivalently 2N/W words denoted t₀, t₁, . . . , t_(2N/W)−1. T is used as a working storage area in which carry and lower partial product terms are accumulated until the final product, x, is generated. The final values for t₀, t₁, . . . , t_(2N/W)−1 are efficiently generated from carry terms, previously-generated lower partial products, and interim values of t₀, t₁, . . . , t_(2N/W)−1 as follows (where the symbol “: =” denotes a processing operation whereby already-existing (“old”) values of terms are combined as indicated on the right side of the symbol, with the result being assigned to the indicated “new” term on the left side of the symbol):

$t_0:=p_{0,0}$ $t_1:=c_{0,0}+p_{1,0}$ $t_2:=c_{1,0}+p_{2,0}$ $⋮$ $t_1:=t_1+p_{0,1}$ $t_2:=t_2+c_{0,1}+p_{1,1}$ $t_3:=t_3+c_{1,1}+p_{2,1}$ $⋮$
That is, operations take place in a right-to-left, top to bottom order, starting with the horizontal direction first as illustrated in FIG. 3. For example, in FIG. 3 it can be seen that the word b₀ is first applied against each of the words a₀ . . . a_(N/W)−1 to generate corresponding lower partial products p_0,0 . . . P_{(N/W)−1,(N/W)−1}, carry terms c_0,0 . . . c_{(N/W)−1, (N/W)−1}, and words t₀ . . . t_(N/W)−1 before the next word b₁ is applied against the words a₀ . . . a_(N/W)−1, and so on.

FIG. 4 is a logic diagram illustrating conventional logic of an exemplary row 301 for implementing multiplication as illustrated in FIG. 3. The first row 303 can be considered a special case in which the values of t₀ . . . t_(N/W)−1 have each been initialized to zero. If the first row 303 is physically implemented by logic as depicted in FIG. 4, it can be efficiently realized by merely omitting the tk inputs from each indicated adder (k=0 . . . (N/W)−1).

FIG. 5 is a logic diagram of a generic one of the conventional partial product generators illustrated in FIG. 4. Mathematically, the outputs from the partial product generator are related to the inputs as follows:
2^Wc_OUT+t_NEW=t_OLD+p_i,j+c_IN,
where P_i,j is a lower partial product. (It will be noted that, in order to ease the notational burden in this description, the carry term supplied to a partial product generator is henceforth referred to as “c_IN”, and the carry term provided as an output from the partial product generator is henceforth referred to as “c_OUT”.) While t_NEW and t_OLD may be maintained separately, in practical embodiments it is often most efficient to maintain a single value of t in storage, with t_OLD being the value read out of storage, and t_NEW being the value to be written back.

It will now be shown how this expression can be used to derive the minimum word length of the carry signal. Since p_i,j=a_ib_j, and a_i, b_j≦2^W−1, it follows that:
p_i,j≦(2^W−1)².
Furthermore, the word length of t is W bits, and thus t≦2^W−1. Thus, if we collect the carry terms on the left side of the relationship, and collect the t terms on the right side of the relationship, we find that
2^Wc_OUT−c_IN=t_OLD−t_NEW+P_i,j.
The right side of the equation can be set to its maximum value by letting t_NEW be set to zero (i.e., its minimum value), and by letting t_OLD and p_i,j each be set to their respective maximum values. This yields the following relationship:

$2^W{c}_{\mathrm{OUT}}-c_{\mathrm{IN}}\le \left(2^W-1\right)+{\left(2^W-1\right)}^2=2^W\left(2^W-1\right)$
Since c_IN is, by definition, greater than or equal to zero, and since the relationship must be true for all values of c_IN (i.e., including c_IN=0), it can be concluded that c_OUT≦(2^W−1). Furthermore, the word length of the carry in signal is the same as the carry out signal. Therefore,
c_IN,c_OUT≦2^W−1.

From the previous discussion, two statements can be made regarding the shown radix-2^W approach:

1. All data words, including carry signals, are W bits wide.

2. The carry propagate chain for the radix-2^W partial product generator approach is 2W bits long.

The length of the carry propagate chain sets the upper limit on the speed of a partial product generator implementation, and the size of the propagated carry sets the limit on the maximum required word length of the data path.

It is common to increase multiplication speed by using modified Booth encoding, Wallace adders to compress the number of partial products, and faster addition schemes for carry propagation summation. Booth encoding is discussed in A. D. Booth, “A signed binary multiplication technique,” Quarterly Journal of Mechanics and Applied Mathematics, vol. 4, pp. 236-240, 1951; and in L. P. Rubinfield, “A proof of the modified Booth algorithm for multiplication,” IEEE Transactions on Computers, October 1975, both of which are hereby incorporated herein by reference. Wallace adders are discussed in C. Wallace, “A suggestion for a fast multiplier,” IEEE Transactions on Electronic Computers, vol. EC-13, February 1964, which is hereby incorporated herein by reference.

The choice of radix for the partial product generation implementation depends on a number of factors, mainly including constraints on clock frequency, area, available data word length, and latency. To have a fast and area-efficient partial product generation, the word length, or radix, has to be limited. A restricted word length results in a larger number of partial products, which takes more time to add together when producing the full word length product. Thus, the choice of a radix for the partial product generator results in a sub-optimal solution.

The use of Booth encoding, or other means to speed up partial product generation, may speed up calculation of the actual partial product, but the word length of the intermediate carry signal remains the same, thus not improving the time required for addition of the partial products.

It is therefore desirable to provide improved methods and apparatuses for multiplying large numbers together.

SUMMARY

It should be emphasized that the terms “comprises” and “comprising”, when used in this specification, are taken to specify the presence of stated features, integers, steps or components; but the use of these terms does not preclude the presence or addition of one or more other features, integers, steps, components or groups thereof.

In accordance with one aspect of the present invention, the foregoing and other objects are achieved in methods, apparatuses and computer readable storage media for multiplying a first number by a second number, where the first number is represented as a first set of one or more W-bit wide numbers, and the second number is represented as a second set of one or more W-bit wide numbers. In accordance with an aspect of the invention, each of the W-bit wide numbers from the first set is paired with each of the W-bit wide numbers from the second set. For each pair of W-bit wide numbers, a set of sub-partial products is generated. Combinations of the sub-partial products are formed such that each combination is representable by a W-bit wide lower partial product and a carry out term that has fewer than W bits. The W-bit wide lower partial products and the carry out terms are combined to form the product of the first number and the second number. In some embodiments, each of the carry out terms is representable by (W/2)+1 bits.

In one aspect, the first number is representable by N bits, N≧0; the second number is representable by M bits, M≧0; for each pair of W-bit wide numbers, (a_i, b_j),
a_i=a_i^H2^W/2+a_i^L and b_j=b_j^H2^W/2+b_j^L,
where a_i^H, a_i^L, b_j^H, b_j^L are each W/2-bit wide numbers, 0≦i≦N/W−1, a 0≦j≦M/W−1. In some embodiments, each of the combinations of the sub-partial products is formed in accordance with:
2^Wc_OUT+p_i=a_i^Lb_j^L+a_i−1^Hb_j^H+2^W/2(a_i^Hb_j^L+a_i^Lb_j^H)+c_IN,
where p_i is a W-bit wide lower partial product, c_IN is a (W/2)+1 bit wide carry-in term, c_OUT is a (W/2)+1 bit wide carry-out term, and a_i-1^H=0 when i=0.

In alternative embodiments, each of the combinations of the sub-partial products is formed in accordance with:
2^Wc_OUT+t_NEW=t_OLD+a_i^Lb_j^L+_i-1^Hb_j^H+2^W/2(a_i^Hb_j^L+a_i^Lb_j^H)+c_IN
where t_OLD is a W-bit wide term representing an accumulation of previously generated lower partial products and carry terms, t_NEW is a W-bit wide term representing a new accumulation of previously and presently generated lower partial products and carry terms, c_IN is a (W/2)+1 bit wide carry-in term, c_OUT is a (W/2)+1 bit wide carry-out term, and a_i−1^H=0 when i=0.

In yet another aspect of the invention, in either of these embodiments, offset binary coding is used to represent a_i; b_j is represented in accordance with

$\{\begin{array}{c}{b}_j^{\sigma }=b_j^L+b_j^H\\ b_j^{\delta }=b_j^L-b_j^H\end{array};$
and
the logic functions of bits of a_i are used to select either b_j^σ or b_j^δ in forming each of the combinations of the sub-partial products.

In still other aspects of the invention, methods, apparatuses and computer readable storage media are for generating a partial product that is for use in multiplying a first number by a second number, wherein the first number is represented as a first set of one or more W-bit wide numbers, and the second number is represented as a second set of one or more W-bit wide numbers. Such methods, apparatuses and computer readable storage media are based on receiving a first W-bit wide number from the first set of one or more W-bit wide numbers; and receiving a second W-bit wide number from the second set of one or more W-bit wide numbers. The first W-bit wide number and the second W-bit wide number are used to generate a set of sub-partial products. Combinations of the sub-partial products are formed such that each combination is representable by a W-bit wide lower partial product and a carry out term that has fewer than W bits.

In some of these embodiments, the carry out term is representable by (W/2)+1 bits.

The various embodiments of the invention may be used whenever multiplication is to be performed between two or more numbers. Because of the many advantageous properties presented by the invention (including those properties expressly stated herein as well as others that are immediately apparent to those skilled in the art), the invention is especially useful whenever large numbers are to be multiplied together. Of course, what constitutes a “large” number will vary from one application to another. In some applications, a number may be considered “large” if it is about 4 times the computational data path (e.g., 4096 bits used in cryptography). Thus, the invention may advantageously be applied in the field of cryptography, as well as many other fields. When used in cryptography, the invention may be used as part of a Montgomery multiplication process, or alternatively as a “stand-alone” process for multiplying two or more numbers together.

BRIEF DESCRIPTION OF THE DRAWINGS

The objects and advantages of the invention will be understood by reading the following detailed description in conjunction with the drawings in which:

FIG. 1 is a diagram showing one partial product slice.

FIG. 2 is a diagram depicting how all of the required partial products are combined to generate a complete product.

FIG. 3 is a diagram illustrating how outputs from partial product slices are combined in a right-to-left, top to bottom order, to generate a final product.

FIG. 4 is a logic diagram illustrating conventional logic of an exemplary row 301 for implementing multiplication as illustrated in FIG. 3.

FIG. 5 is a logic diagram of a generic one of the conventional partial product generators illustrated in FIG. 4.

FIG. 6 illustrates a technique for multiplying two numbers together by breaking them up into numbers that are representable by fewer bits than the original two numbers, multiplying these numbers together to generate partial products, and then combining these partial products to generate the desired product.

FIG. 7 is a diagram that illustrates a technique for generating the partial products of FIG. 6 by breaking up the numbers into other numbers representable by even fewer bits, multiplying these numbers together to generate other partial products, and then combining these other partial products together to generate the desired partial product.

FIG. 8 is a diagram that illustrates, for the case of W/2-bit by W/2-bit multiplications, how the sub-partial products take the place of the partial products shown in FIG. 6.

FIG. 9 is a flow diagram that illustrates the general case of the split-radix multiplication techniques described herein.

FIG. 10 illustrates how the sub-partial products generated from a W-bit by W-bit multiply may be advantageously grouped for the cases in which for each pair of W-bit wide numbers, a set of sub-partial products is generated by performing W/2 by W/2-bit multiplications.

FIG. 11 is a block diagram of a new partial product generator based on the above-described groupings.

FIG. 12 is a diagram depicting how all of the required partial products are mathematically combined to generate a complete product in accordance with an aspect of the invention.

FIG. 13 is a logic diagram of an embodiment of a new partial product generator that also accumulates sub-partial products of like significance from earlier operations.

FIG. 14 illustrates the division of the input words into W×W blocks that the algorithm works on, in accordance with an aspect of the invention.

FIG. 15 illustrates how a split radix Montgomery algorithm is created, in accordance with an aspect of the invention, by dividing all computing blocks of FIG. 14 into sub-blocks containing three or four radix-2^W/2 blocks.

DETAILED DESCRIPTION

The various features of the invention will now be described with reference to the figures, in which like parts are identified with the same reference characters.

The various aspects of the invention will now be described in greater detail in connection with a number of exemplary embodiments. To facilitate an understanding of the invention, many aspects of the invention are described in terms of sequences of actions to be performed by elements of a computer system. It will be recognized that in each of the embodiments, the various actions could be performed by specialized circuits (e.g., discrete logic gates interconnected to perform a specialized function), by program instructions being executed by one or more processors, or by a combination of both. Moreover, the invention can additionally be considered to be embodied entirely within any form of computer readable carrier, such as solid-state memory, magnetic disk, optical disk or carrier wave (such as radio frequency, audio frequency or optical frequency carrier waves) containing an appropriate set of computer instructions that would cause a processor to carry out the techniques described herein. Thus, the various aspects of the invention may be embodied in many different forms, and all such forms are contemplated to be within the scope of the invention. For each of the various aspects of the invention, any such form of embodiments may be referred to herein as “logic configured to” perform a described action, or alternatively as “logic that” performs a described action.

To overcome the problem of the sub-optimal radix selection, the techniques described herein use dual radices: one for the word length of the computational data path, and one for the calculations of the partial products. This is referred to herein as “split radix”. Using dual radices helps reach a more optimal implementation: data is addressed with a larger word length, and arithmetic operations in the partial product generator are made with a smaller word length. As a result, the data bandwidth remains the same while arithmetic calculations become faster and more efficient.

To facilitate an understanding of the basis for the split radix design, consider FIG. 6, which illustrates partial products that are generated when multiplying together two operands, a and b. Assume that the lengths of a and b are each integer multiples of a word length W. (Even if they are not initially of such a length, their length could always be extended as necessary—for example by padding with zeroes or by sign extension—to force their lengths to be integer multiples of W.) As explained in the Background section, the N-bit number a can then be written as a sequence of W-bit words a_i as

$a=\sum _{i=0}^{N/W-1}{a}_i{2}^{\mathrm{Wi}}.$
Similarly, the M-bit number b can be written as a sequence of W-bit words b_j as

$b=\sum _{j=0}^{M/W-1}{b}_j{2}^{\mathrm{Wj}}.$
The multiplication of the two words, x=ab may be calculated by generating partial products from the W-bit words a_i and b_j, and combining the partial products. More specifically, the product x may be calculated according to

$x=\sum _{i=0}^{N/W-1}\sum _{j=0}^{M/W-1}{a}_i{b}_j{2}^{W\left(i+j\right)},$
where the partial product, x_i,j is generated from two W-bit numbers, a_i and b_j as
x_i,j=a_ib_j.

Each of the partial products x_i,j will be 2W bits long. In practical implementations, the multiplication by 2^W(i+j) is performed by aligning the partial product x_i,j so that it has the proper significance when combined with other partial products. For example, the partial product x_i,j may be left-shifted by W(i+j) bits (inserting “zeroes” as the fill bits) in order to accomplish the multiplication by 2^W(i+j).

This technique for multiplying two numbers together is illustrated in FIG. 6. Here it can be seen that a first partial product, a₀b₀, is generated by multiplying the two words a₀ and b₀ together. A next partial product a₁b₀ is generated by multiplying the two words a₁ and b₀ together. To effect multiplying the partial product a₁b₀ by 2^W(0+1)=2^W, the partial product a₁b₀ is aligned W bits to the left of the first partial product a₀b₀. The remaining partial products are similarly generated and aligned, so that they may be summed to form the final product ab, as shown in the figure.

In accordance with one aspect of the invention, it is recognized that each of the W-bit by W-bit multiplies can itself be broken up into a series of W/2-bit by W/2-bit multiplies. Mathematically, what we have is a₁=a_i^H2^W/2+a_i^L and b_j=b_j^H2^w/2+b_j^L. The product a_ib_j is then generated as

$\begin{array}{c}{a}_i\times b_j=\left(a_i^H{2}^{W/2}+a_i^L\right)\times \left(b_j^H{2}^{W/2}+b_j^L\right)\\ =a_i^H{b}_j^H{2}^W+\left(a_i^H{b}_j^L+a_i^L{b}_j^H\right)2^{W/2}+a_i^L{b}_j^L\end{array}$
FIG. 7 is a diagram that illustrates these partial products being generated and properly aligned to permit their sum to represent the product a_ib_j.

In accordance with another aspect of the invention, each of the W-bit by W-bit multiplies illustrated in FIG. 6 can itself be broken up into a series of smaller multiplications, such as a series of W/2-bit by W/2-bit multiplies as illustrated in FIG. 7. This results in the generation of what are herein referred to as sub-partial products. For the case of W/2-bit by W/2-bit multiplies, FIG. 8 illustrates how the sub-partial products take the place of the partial products shown in FIG. 6.

In the general case, the split-radix multiplication technique includes the steps illustrated in FIG. 9. To multiply a first number by a second number, the first number is represented as a first set of one or more W-bit wide numbers (step 901), and the second number is represented as a second set of one or more W-bit wide numbers (step 903). Each of the W-bit wide numbers from the first set is paired with each of the W-bit wide numbers from the second set (step 905). For each pair of W-bit wide numbers, a set of sub-partial products is generated (step 907). Combinations of the sub-partial products are formed such that each combination is representable by a W-bit wide lower partial product and a carry out term that has fewer than W bits (step 909). For example, when the sub-partial products are the result of performing W/2 by W/2-bit multiplications, the carry out terms are representable by (W/2)+1 bits. The W-bit wide lower partial products and the carry out terms are combined to form the product of the first number and the second number (step 911).

In accordance with yet another aspect of the invention in which for each pair of W-bit wide numbers, a set of sub-partial products is generated by performing W/2 by W/2-bit multiplications, the sub-partial products generated from the W-bit by W-bit multiply may be advantageously grouped as illustrated in FIG. 10. Two types of groupings are illustrated: a first grouping type 1001 that involves the addition of four sub-partial products, and a second grouping type 1003 that involves the addition of only three sub-partial products. The second grouping type 1003 can be considered a special case of the first grouping type 1001, in which one of the four sub-partial products is always zero.

In some embodiments, a third grouping can also be constructed for use in the most-significant position of the partial product generation (e.g., the left-most position of a row of sub-partial product generators) in that fewer than four sub-partial products will need to be combined in this position. In many embodiments, it is advantageous simply to use enough ones of the first grouping type 1001 for the size of the product that it is intended to generate.

In accordance with an aspect of the invention, a new type of partial product generator (PPG) generates its outputs based on these groupings. In the general case, the new partial product generator receives a_i, b_j, a^H_i-1, a value t, and a carry-in value (c_in) as its input parameters (where i=0, . . . , L−1; and L=the number of W-bit words that make up the number a). The final values for t₀, t₁, . . . , t_(2N/W)−1 may be efficiently generated from carry terms, previously-generated lower partial products, and interim values of t₀, t₁, . . . , t_(2N/W)−1 in the manner previously described with respect to the conventional PPG, except that it will be recognized that different values will be obtained because the carry terms themselves will take on different values.

Like the conventional type PPG, the new PPG uses W-bit wide input operands (except for the carry-in operand, which is only

$\frac{W}{2}+1$
bits wide). However, unlike the conventional type PPG, the new PPG generates an output that is, in total,

$\frac{3W}{2}+1$
bits wide.

A new PPG 1101 based on the above-described groupings can be schematically depicted as in FIG. 11. Here it can be seen that the a_i and b_j inputs are only W-bits wide, and that the output from this new PPG 1101 is

$\frac{3W}{2}+1$
bits wide. The shape depicted in FIG. 11 is representational of the significance of the four sub-partial products that are summed within the new PPG 1101.

In another aspect of the invention, the

$\frac{3W}{2}+1$
bit wide output from the new PPG is divided into a W-bit wide lower partial product p_i,j that is propagated in a vertical direction (i.e., combined with previously-generated and later-generated terms of like significance), and

$\frac{W}{2}+1$
carry part c_i,j that is propagated in the horizontal direction (i.e., to a term of higher significance).

Operations using the new PPG take place in a right-to-left, top to bottom order, starting with the horizontal direction first as earlier-illustrated in FIG. 3.

FIG. 12 is a diagram depicting how all of the required partial products are mathematically combined to generate the complete product. It is apparent from the figure that the computed result from one slice should be combined with the result from the neighboring slices to the left and right, and that these combination results are also accumulated with the values generated by the slices above and below. It can be seen in the figure that in each row, the right-most (i.e., least significant) PPG is depicted in the shape of the number “7”, to indicate that only three sub-partial products are generated and accumulated within the PPG.

FIG. 13 is a logic diagram of an embodiment of a new PPG 1301 that also accumulates sub-partial products of like significance from earlier operations. Consequently, the output of the new PPG 1301 includes a t term rather than a p term as the lower partial product. As can be seen, this is a very compact design that utilizes only four size W/2×W/2 multipliers 1303, 1305, 1307, 1309. These multipliers 1303, 1305, 1307, 1309 are arranged, along with three adders 1311, 1313, 1315 to generate carry-out (c_OUT) and t_NEW as follows:
2^Wc_OUT+t_NEW=t_OLD+a_i^Lb_j^L+a_i-1^Hb_j^H+2^W/2(a_i^Hb_j^L+a_i^Lb_j^H)+c_IN,
where the symbols a_i^L, a_i^H denote the lower and higher W/2 bits of a_i, respectively, and similar notation is used for the b variable. Additional logic 1317 is illustrated in the figure to represent scaling the output of the adder 1313 by a factor of 3^W/2. However, because this is multiplication by a power of 2, it can advantageously be implemented merely by aligning the output of the adder 1313 by W/2 bits to the left (i.e., to a position of higher significance), or by performing a comparable left shift operation. Thus, it is unnecessary to use actual multiplication circuitry to accomplish this function. Also, while t_NEW and t_OLD may be maintained separately, in practical embodiments it is often most efficient to maintain a single value of t in storage, with t_OLD being the value read out of storage, and t_NEW being the value to be written back—such an embodiment is illustrated in FIG. 13.

It is possible to use the embodiment of FIG. 13 throughout the entire multiplication process if the value “0” is used for a₋₁^H whenever i=0. Alternatively, the design depicted in FIG. 13 may be modified to effect a special-case version of the PPG for use whenever i=0 (i.e., for use as the right-most—i.e., least-significant—PPGs depicted in FIG. 12). This modification involves the removal of the multiplier 1305 and the adder 1311, and supplying the output of the multiplier 1303 directly to the adder 1315.

While t_NEW and t_OLD may be maintained separately, in practical embodiments it is often most efficient to maintain a single value of t in storage, with t_OLD being the value read out of storage, and t_NEW being the value to be written back.

It will now be shown how this expression can be used to derive the maximum word length of the carry signal. Since 0≦a_i^H, a_i^L, a_i-1^H, b_j^H, b_j^L≦2^W/2−1, it follows that:
a_i^Hb_j^H,a_i^Lb_j^H,a_i^Hb_j^L,a_i^Lb_j^L,a_i-1^Hb_j^H≦(2^W/2−1)².
Furthermore, the word length of t is W bits, and thus t≦2^W−1. Thus, if we collect the carry terms on the left side of the relationship, and collect the t terms on the right side of the relationship, we find that
2^Wc_OUT−c_IN=t_OLD−t_NEW+a_i^Lb_j^L+a_i-1^Hb_j^H+2^W/2(a_i^Hb_j^L+a_i^Lb_j^H).
The right side of the equation can be set to its maximum value by letting t_NEW be set to zero (i.e., its minimum value), and by letting t_OLD and each of the sub-partial products be set to their respective maximum values. This yields the following relationship:

$2^W{c}_{\mathrm{OUT}}-c_{\mathrm{IN}}\le \left(2^W-1\right)+2{\left(2^{W/2}-1\right)}^2+2^{W/2}\times 2{\left(2^{W/2}-1\right)}^2=\left(2^W-1\right)+2{\left(2^{W/2}-1\right)}^2\left(1+2^{W/2}\right)=\left(2^W-1\right)+{\left(2^{W/2}-1\right)}^2\times 2\left(1+2^{W/2}\right)=\left(2^W-1\right)+\left(2^W-2^{\left(W/2\right)+1}+1\right)\times 2\left(1+2^{W/2}\right)=\left(2^W-1\right)+\left(2^W-2^{\left(W/2\right)+1}+1\right)\left(2+2^{W/2+1}\right)=\left(2^W-1\right)+\left(2^{\left(3W/2\right)+1}-2^{W+2}+2^{\left(W/2\right)+1}+2^{W+1}-2^{\left(W/2\right)+2}+2\right)=2^{\left(3W/2\right)+1}-2^{W+2}+2^{W+1}+2^W-2^{\left(W/2\right)+2}+2^{\left(W/2\right)+1}+2-1<2^{\left(3W/2\right)+1}$
Since c_IN is, by definition, greater than or equal to zero, and since the relationship must be true for all values of c_IN (i.e., including c_IN=0), it can be concluded that c_OUT<2^(W/2)+1. Furthermore, the word length of the carry in signal is the same as the carry out signal. Therefore,
c_IN,c_OUT<2^(W/2)+1.
That is, the intermediate right-to-left propagating carry for the partial product generator 201 is only half the size of the conventional approach plus one bit.

The gain from using the new split-radix multiplication method compared to the conventional technique can also be computed. Assume the word length is W bits. The conventional approach to partial product generation utilizes W×W multipliers. This results in a carry propagate chain of 2W adder cells. For the new split radix multiplier, the corresponding number of cells is W+W/2+1 Thus, the carry chain is reduced by a factor

$\text{carry chain reduction}=1-\frac{W+W/2+1}{2W}=\frac{1}{4}-\frac{1}{2W},$
that is, approaching 25% for large values of W. Two examples of realistic scenarios are:

Example 1: 16×16 bit partial product. Reduction is 21.9%

Example 2: 32×32 bit partial product. Reduction is 23.4%.

For multipliers and adders, the carry propagate chain is equal to the critical path. Therefore, a shorter carry chain implies an implementation of lower cost in terms of delay, area, and power consumption.

It is not possible to make a general statement about the exact magnitude of the gain because of the wide range of different multiplication and addition schemes. However, for the common ripple-carry addition scheme, often used in multipliers, the reduced carry chain implies linear reduction in delay and area, and linear or even polynomic improvement in energy per operation.

The new split radix multiplication scheme can be further optimized by using distributed arithmetic and offset binary coding, as described in A. Croisier et al., U.S. Pat. No. 3,777,130, entitled “Digital filter for PCM encoded signals” (issued December 1973); A. Peled and B. Liu, “A new hardware realization of digital filter,” IEEE Transactions on Acoustics, Speech, and Signal Processing, vol. ASSP-22, no. 6, December 1974; and A. Berkeman et al., “A low logic depth complex multiplier using distributed arithmetic,” IEEE Journal of Solid-State Circuits, vol. 35, no. 4, pp. 656-659, April 2000, each of which is hereby incorporated herein by reference. Where the a_i signals are offset binary coded, the b_j signals may be recoded as follows:

$\{\begin{array}{c}{b}_j^{\sigma }=b_j^L+b_j^H\\ b_j^{\delta }=b_j^L-b_j^H\end{array}.$
The following identities are also utilized:
a_i^Lb_j^L+a_i^Hb_j^L=F(a_i^L,a_i^H,b_j^σ,b_j^δ),
a_i-1^Hb_j^H+a_i^Lb_j^H=F(a_i-1^H,a_i^L,b_j^σ,b_j^δ)
where the F( )-function denotes a second order distributed arithmetic multiplier with offset binary encoded input signals. Further information about this may be found in A. Berkeman and V. Öwall, “Co-Optimization of FFT and FIR in a Delayless Acoustic Echo Canceller Implementation,” Proceedings of ISCAS 2000, Geneva, Switzerland, May 2000. With this construction, the number of partial product bits for the four W/2-sized multipliers are reduced to approximately one half, with a corresponding decrease in the number of required adders in the multipliers. The recoding of the b-signals can be implemented either prior to the multiplication operation, or in the right-most partial product generator stage. A further advantage with the distributed arithmetic multipliers is that the adder 1315 with four inputs as shown in FIG. 13 is replaced by a more efficient three word input adder.

In yet another aspect of the invention, Montgomery's method of operating on data divided into words of W bits can be implemented in an algorithm that computes the product
p=abr⁻¹ mod n,
where r=2^DW is constant. The algorithm is as follows:

1:  n0′ ← (−n−1) mod 2W
2:  t ← 0
3:  for i = 0 to D − 1 do
4:  c ← 0
5:  for j = 0 to D − 1 do
6:  if j = 0 then
7:  mi ← (t0 + a0bi)n0′ mod 2W
8:  end if
9:  2W c + tj ← tj + ajbi + njmi + c
10: end for
11: t ← t/2W
12: end for
13: if t ≧ n then
14: p ← t − n
15: else
16: p ← t
17: end if

For each iteration of the loop variable i, the least significant W bits are set to zero and the partial result is shifted W bits to the right.

FIG. 14 illustrates the division of the input words into W×W blocks that the algorithm works on. There are two different kinds of blocks: right-most (i.e., least significant) preprocessing blocks (identified by “pre-proc” in the figure) that perform the zeroing of the least significant word according to lines 6-9 of the algorithm; and “standard” Montgomery blocks (identified by “MPPG” in the figure) that compute only line 9 of the algorithm. The standard Montgomery blocks dominate the complexity of the algorithm.

The split radix Montgomery algorithm is created by dividing all computing blocks of FIG. 14 into sub-blocks, containing three or four radix-2^W/2 blocks (identified as “MsPPG” in the figure) as illustrated in FIG. 15. In the figure, the square brackets indicate that the designated data has to be read from or written to a memory. Other variables are passed between the consecutive steps and stored intermediately.

Using the notation ñ=n′₀ mod 2^W/2, and a_j^L, a_j^H are the least and most significant W/2 bits of a_j, and so forth, the rightmost blocks of FIG. 15 compute the following operations:
MemRead: t=t₀, a=a₀, n=n₀, b=b_i
1: (2^W/2c₀+s₀)←t^L+a^Lb^L
2: m^L←s₀ñ mod 2^W/2
3: (2^W/2c₀+s₀)←(2^W/2c₀+s₀)+n^Lm^L
4: (2^W/2c₁+s₁)←t^H+a^Hb^L+a^Lb^H+n^Hm^L+c₀
5: m^H←s₁ñ mod 2^W/2
6: (2^W/2c₁+s₁)←(2^W/2c₁+s₁)+n^Lm^H
thereby zeroing the least W bits (corresponding to t^H and t^L) and feeding a carry c=c₁, and the signals b and m to the next step. The remaining blocks then compute:
MemRead: t=t_j, a=a_j, n=n_j, c
1: (2^W/2c₀+s₀)←t^L+a^Lb^L+a′^Hb^H+n^Lm^L+n′^Hm^H+c
2: (2^W/2c₁+s₁)←t^H+a^Hb^L+a^Lb^H+n^Hm^L+n^Lm^H+c₀
MemWrite: t_i-1=2^W/2 s₁+S₀
Between the blocks, a carry c=c₁ is propagated, as well as the values that are shared and propagated: a′^H=a_j−1^H, n′^H=n_j−1^H, b_i, and m_i.

Looking again at the operations performed in the non-rightmost blocks in FIG. 14, it can be seen that eight W/2×W/2 multiplications are required. One W×W multiplier is equivalent to four W/2×W/2 multipliers in terms of the number of partial product bits, but as seen before in the general case, the reordering shortens the length of the carry chain, and reduces the word length of the intermediate carry signal.

Applying distributed arithmetic and offset binary coding, denote

$\{\begin{array}{c}{b}_i^{\sigma }=b_i^H+b_i^L\\ b_i^{\delta }=b_i^H-b_i^L\end{array}\mathrm{and}\{\begin{array}{c}{m}_i^{\sigma }=m_i^H+m_i^L\\ m_i^{\delta }=m_i^H-m_i^L\end{array}.$
Then, the scalar products can be written more efficiently as
a^Lb^L+a′^Hb^H=F(a^L,a′^H,b_σ,b_δ)
n^Lm^L+n′^Hm^H=F(n^L,n′^H,m_σ,m_δ)
a^Hb^L+a^Lb^H=F(a^H,a^L,b_σ,b_δ)
n^Hm^L+n^Lm^H=F(n^H,n^L,m_σ,m_δ)
where the F-function denotes a distributed arithmetic multiplier as before.

A further optimization step is found by generating all of the sums and differences of b_σ, b_δ, m_σ, and m_δ; in total 16 combinations. Actually, only half of them need be generated because the other half have the same absolute value but opposite sign. Now, only hardware corresponding to one size W/2×W/2 multiplier plus some multiplexers is required for the implementation, and the memory addressing scheme still remains the same.

The above-described strategy for multiplying numbers together has advantageous properties, including but not limited to the following:

1. The same addressing and word lengths are used as in the conventional approach. That is, since the input/output data word length is kept at W bits, the same number of partial products is generated as in the conventional approach, and accessing of data remains the same.

2. The carry propagate chain is shortened from 2W bits to 3W/2+2 bits. Having a shorter carry propagate chain means that the calculation and addition of a partial product will be faster than in the conventional approach. Furthermore, switching activity is reduced, and energy consumption is lower.

3. The intermediate carry signal is shortened from W bits to W/2+1 bits. Thus, fewer bits have to be propagated and added from one slice to a following slice. This helps increase speed and reduce energy consumption due to less switching activity.

4. The only additional requirement is intermediate forwarding of the W/2 bits of a_i-1^H.

5. The required hardware area for implementation of the new multiplication strategy will be the same or less than that required for the conventional approach due to the reduced word length of the carry signals.

6. Modified Booth encoding and similar devices are still applicable to the radix-2^W/2 multipliers, further reducing delay and area.

7. Distributed arithmetic and offset binary coding is an efficient means to reduce speed and area of the split radix partial product generator.

8. Applications include efficient calculation of Montgomery multiplication, for use in, for example, cryptographic applications.

9. Applications, including cryptographic applications, may use the split-radix multiplication techniques “as is” (i.e., outside the context of Montgomery multiplication).

The invention has been described with reference to a particular embodiment. However, it will be readily apparent to those skilled in the art that it is possible to embody the invention in specific forms other than those of the preferred embodiment described above. This may be done without departing from the spirit of the invention.

For example, an embodiment was described above with respect to FIG. 13 in which a new PPG 1301 also accumulates sub-partial products of like significance from earlier operations. However, in alternative embodiments, it is possible for each PPG to merely generate
2^Wc_OUT+p_i=a_i^Lb_j^L+a_i-1^Hb_j^H+2^W/2(a_i^Hb_j^L+a_i^Lb_j^H)+c_IN,
where p_i is a W-bit wide lower partial product. In this embodiment, the accumulation is performed separately in one or more subsequent steps.

Also, the invention has been described in the context of multiplying two numbers together. However, it will be readily apparent that the same principles of split-radix multiplication may be applied to perform multiplication between more than two numbers. In such cases, sub-partial products are formed from the various operands and combined in the manner described above.

Thus, the preferred embodiment is merely illustrative and should not be considered restrictive in anyway. The scope of the invention is given by the appended claims, rather than the preceding description, and all variations and equivalents that fall within the range of the claims are intended to be embraced therein.

Claims

1. An apparatus for multiplying a first number by a second number, the apparatus comprising:

first representation circuitry that represents the first number as a first set of two or more w-bit wide numbers, wherein w is an integer greater than or equal to 2;

second representation circuitry that represents the second number as a second set of one or more w-bit wide numbers;

pairing circuitry that pairs each of the w-bit wide numbers from the first set with each of the w-bit wide numbers from the second set;

sub-partial product generation circuitry that generates a set of sub-partial products for each pair of w-bit wide numbers;

combination forming circuitry that forms combinations of the sub-partial products such that each combination is representable by a w-bit wide lower partial product and a carry out term that has fewer than w bits; and

combining circuitry that combines the w-bit wide lower partial products and the carry out terms to form the product of the first number and the second number.

2. The apparatus of claim 1, wherein each of the carry out terms is representable by (w/2)+1 bits, wherein w is an even number.

3. The apparatus of claim 2, wherein:

the first number is representable by N bits N≧2;

the second number is representable by M bits, M≧2;

for each pair of w-bit wide numbers, (a_i, b_j),

a_i=a_i^H2^w/2+a_i^L and b_j=b_j^H2^w/2+b_j^L,

4. The apparatus of claim 3, comprising:

logic that uses offset binary coding to represent a_i;

logic that represents b_j in accordance with

5. The apparatus of claim 2, wherein:

the first number is representable by N bits N≧2;

the second number is representable by M bits, M≧2;

for each pair of w-bit wide numbers, (a_i, b_j),

a_i=a_i^H2^w/2+a_i^L and b_j=b_j^H2^w/2+b_j^L,

6. The apparatus of claim 5, comprising:

logic that uses offset binary coding to represent a_i;

logic that represents b_j in accordance with

7. A partial product generator for use in multiplying a first number by a second number, wherein the first number is represented as a first set of two or more w-bit wide numbers, and the second number is represented as a second set of one or more w-bit wide numbers, the apparatus comprising:

first receiving circuitry that receives a first w-bit wide number from the first set of two or more w-bit wide numbers, wherein Wis an integer greater than or equal to 2;

second receiving circuitry that receives a second w-bit wide number from the second set of one or more w-bit wide numbers;

sub-partial product generation circuitry that uses the first w-bit wide number and the second w-bit wide number to generate a set of sub-partial products; and

combination forming circuitry that forms combinations of the sub-partial products such that each combination is representable by a w-bit wide lower partial product and a carry out term that has fewer than w bits.

8. The partial product generator of claim 7, wherein each of the carry out terms is representable by (w/2)+1 bits, wherein w is an even number.

9. The partial product generator of claim 8, wherein:

the first number is representable by N bits N≧2;

the second number is representable by M bits, M≧2;

for each pair of w-bit wide numbers, (a_i, b_j), that are input into the partial product generator,

a_i=a_i^H2^w/2+a_i^L and b_j=b_j^H2^w/2+b_j^L,

10. The partial product generator of claim 9, comprising:

logic that uses offset binary coding to represent a_i;

logic that represents b_j in accordance with

11. The partial product generator of claim 8, wherein:

the first number is representable by N bits N≧2;

the second number is representable by M bits, M≧2;

for each pair of w-bit wide numbers, (a_i, b_j), that are input into the partial product generator,

a_i=a_i^H2^w/2+a_i^L and b_j=b_j^H2^w/2+b_j^L,

12. The partial product generator of claim 11, comprising:

logic that uses offset binary coding to represent a_i;

logic that represents b_j in accordance with

13. An apparatus for performing montgomery multiplication between a first number and a second number, wherein the first number is represented as a first set of two or more w-bit wide numbers, and the second number is represented as a second set of one or more w-bit wide numbers, the apparatus comprising:

first number input circuitry that receives a first w-bit wide number from the first set of two or more w-bit wide numbers, wherein w is an integer greater than or equal to 2;

second number input circuitry that receives a second w-bit wide number from the second set of one or more w-bit wide numbers;

sub-partial product generation circuitry that uses the first w-bit wide number and the second w-bit wide number to generate a set of sub-partial products; and

combination forming circuitry that forms combinations of the sub-partial products such that each combination is representable by a w-bit wide lower partial product and a carry out term that has fewer than w bits.